Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Fuck Society Ransomware – Remove it and Restore .dll Files

stf-fucksociety-ransomware-fuck-society-virus-ransom-note-name-middle-finger-fsociety

Fuck Society ransomware isn’t the first cryptovirus with that theme. This one however claims to use RSA with 4096 bits for the encryption process. All encrypted files will have the extension .dll. That is troubling, because if you tamper with all files which have that extension on a massive scale, you might break your operating system. To see how to remove the ransomware and how you can try to restore your files, read the article carefully.

Threat Summary

Name Fuck Society
Type Ransomware, Cryptovirus
Short Description The ransomware will encrypt your files and then display a ransom note with an obscene gesture and instructions for paying the ransom.
Symptoms All encrypted files will get the extension .dll appended to them.
Distribution Method Spam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Fuck Society

Download

Malware Removal Tool

User Experience Join Our Forum to Discuss Fuck Society.
Data Recovery Tool Data Recovery Pro by ParetoLogic Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Fuck Society Ransomware – Spread

The Fuck Society ransomware virus might infiltrate your PC system by using various methods. The payload file might be spread with spam e-mails. Such e-mails are written in a way to make you think that they are of high importance, including the files attached to them. If you don’t do the necessary checks and rush into opening the attachment that will release the malicious payload. That means that your computer machine will get infected.

Fuck Society ransomware could infect your computer with other, alternative methods. For instance, the creators of this cryptovirus could spread their malware with the help of payload files pretending to be useful programs across the Internet. Social media networks and file-sharing services are mostly the platforms used for that purpose. Do not open files, from suspicious sources, especially if they come from such e-mails and links. Always perform a scan with a security program and check the file’s size and signature first. You should read the ransomware prevention tips from the thread inside the forum.

Fuck Society Ransomware – Information

A ransomware cryptovirus that calls itself Fuck Society has been found in the wild. The ransom note starts with an obscene gesture and seems to be a reference to Mr. Robot and fsociety. The virus does seem to share a common theme with the Fs0ci3ty virus and the Fsociety ransomware. Besides the theme and the fact that all three are ransomware cryptoviruses, they seem unrelated and from different authors.

When your files get encrypted, they will have the extension .dll appended to all of them. That stands for Dynamic-link Library File and some critically important files responsible for the launching and running the Windows operating system have that extension. This means that you have to be careful if you try to recover your encrypted files.

When the Fuck Society ransomware unleashes its payload, it could create entries inside the Windows Registry. That is done for making the ransomware achieve a bigger level of persistence. Those registry entries can make the virus launch automatically with each boot of the Windows operating system. Your files will then become encrypted, and afterward, the ransom note will display on your desktop screen.

Here you can see how the full ransom message looks like:

stf-fucksociety-ransomware-fuck-society-virus-ransom-note-message-full

The full ransom note is included in a document named DECRYPT_YOUR_FILES.html and reads the following:

Fsociety
All your files have been encrypted with Fuck Society Ransomware
YOU HAVE 5 DAY TO MAKE PAYMENT OR ALL YOUR FILES HAVE BEEN DELETED!
For each file unique, strong key. Algorithm RSA4096 look at
https://en.wikipedia.org/wiki/RSA_(cryptosystem)
– All your attempts to restore files on their own, lead to the loss of the possibility of recovery and we are not going to help you.
Your unique ID for decrypt: 57002ca9-084a-47c3-9390-0e625389c2ae
FOR DECRYPT YOUR FILES, BUY YOUR UNIQUE DECRYPTION CONFIG:
https://satoshibox.com/eicwgigj8evd65qn4it8q3m4/buy
In file you find link to decryptor , and link to decryption config file
Make your Bitcoin Wallet on:
block.io
coinbase.com
blockchain.info
YOU CAN BUY BITCOINS ON:
btc-e.nz
localbitcoins.com
AND OTHER EXCHANGE SITES.

You are given a deadline of five days, and you are threatened with the deletion of your files if you do not meet that deadline. From visiting the given website address, you can see the Bitcoin address and that you are asked to pay 2 Bitcoins. The ransomware threatens to delete files. You should NOT even be thinking of contacting the cybercriminals or funding their criminal acts. Nobody can guarantee that all of your files will return to normal if you pay up. Furthermore, the criminals will probably just make more ransomware viruses.

You can view the Bitcoin address from the below screenshot:

stf-fucksociety-ransomware-fuck-society-virus-ransom-bitcoin-address-site-satoshi

The Fuck Society ransomware uses the RSA algorithm with 4096 bits for encryption. A list of file extensions which the ransomware seeks to encrypt is not yet available, but the file types are very probable to be documents, photos, and files that the majority of people use.

The Fuck Society cryptovirus is very possible to erase the Shadow Volume Copies from the Windows operating system by using the following command:

→vssadmin.exe delete shadows /all /Quiet

Read more to see the different methods you could try out to restore at least some of your data.

Remove Fuck Society and Restore .dll Files

If your computer got infected with the Fuck Society ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Fuck Society.

Manually delete Fuck Society from your computer

Note! Substantial notification about the Fuck Society threat: Manual removal of Fuck Society requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Fuck Society files and objects
2.Find malicious files created by Fuck Society on your PC

Automatically remove Fuck Society by downloading an advanced anti-malware program

1. Remove Fuck Society with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Fuck Society
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.